Expose PostgREST's `pre-request` config option to enable revoking long-lived tokens

Feature request

Expose PostgREST’s pre-request config option to enable revoking long-lived tokens

Is your feature request related to a problem? Please describe.

This issue is based on this discussion: https://github.com/supabase/supabase/discussions/3205

There is more detail in the discussion linked above, but to summarize my use case:

1. I’d like to give long-lived JWTs to users of my webapp to use as API keys (akin to Stripe tokens or Supabase’s service_role token)
2. I’d like to let users revoke and regenerate these tokens in my webapp’s UI (so they can handle security issues on their end, like leaks or employee offboarding)
3. Supabase currently has no way to apply some security middleware (e.g. to check “is this request’s token/claim in my list of revoked tokens?”)

There are similar use cases, like this discussion https://github.com/supabase/supabase/discussions/2265 about wanting to revoke a service_role JWT (without needing to contact supabase support to do so).

Describe the solution you’d like

As suggested in PostgREST’s docs on revocation, it would be nice to have a pre-request function that can run for all API requests. Maybe this option could be exposed in the Supabase Admin UI as a new API setting? Or, maybe this option could be specified in the database via PostgREST’s In-Database Configuration, though this method seems to require SUPERUSER.

Describe alternatives you’ve considered

As described in the github discussion (https://github.com/supabase/supabase/discussions/3205), an alternative would be to add a revocation-check policy to every table, which is not-DRY and is error-prone due to the duplication, as well as bad for performance (if a single request makes many queries, or even a single query across many tables, the revocation check is evaluated repeatedly).

Other alternatives I can think of would be even worse (e.g. putting a revocation-checking proxy service in front of the Supabase API, sending all API requests to some database function that does revocation-checking then dispatches to other tables, e.g. /rpc/dispatcher?table=profiles&payload=...).

Additional context

It looks like y’all are already working on exposing other PostgREST config options, like db-schema according to this discussion: https://github.com/supabase/supabase/discussions/1222

Implementing this feature request would hopefully share a lot of the same work and be not-too-onerous as a result! 🤞

[felixzy-attentec]

@psteinroe I had to run ALTER ROLE postgres instead of ALTER ROLE authenticator to get this to work. Does this match your experience or what did you do to get ALTER ROLE authenticator to work?

[psteinroe]

I just received answer from the (super awesome) supabase support and they hinted that db-pre-request can already be set!

ALTER ROLE authenticator SET pgrst.db_pre_request to 'your_custom_function';
NOTIFY pgrst, 'reload config';

and to reset

ALTER ROLE authenticator RESET pgrst.db_pre_request;
NOTIFY pgrst, 'reload config';

more details here!